CVE-2022-21670

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400 CWE-1333

Affected software

Vendor	Product	Versions
markdown-it	markdown-it	< 12.3.2

References

https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101Patch, Third Party Advisory
https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6vfc-qv3f-vr6cExploit, Third Party Advisory
https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101Patch, Third Party Advisory
https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6vfc-qv3f-vr6cExploit, Third Party Advisory

Timeline

Published: Jan 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-216716.5@replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive informati CVE-2022-216726.5make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers. Starting with version 0.9 and prior to CVE-2022-216734.3Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity CVE-2022-216757.8Bytecode Viewer (BCV) is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File CVE-2022-216767.5Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially CVE-2022-216775.3Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as CVE-2022-216784.3Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `be CVE-2022-216799.8Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and n CVE-2022-21686.1The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history CVE-2022-216807.5Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking ag CVE-2022-216817.5Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic back CVE-2022-216826.5Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.